AMENDMENTS TO THE CLAIMS 

Without prejudice, please amend the claims as reflected in the following listing of 
claims, which will replace all prior versions, and listings, of claims in the 
application: 



Listing of Claims: 



1. (Currently Amended) A method of detecting bandwidth anomalies in 
a data communication system, the method comprising: 

receiving a first traffic waveform representing a time distribution of 
data volume in a first direction in said data communication system 
in a first period of time; 

receiving a second traffic waveform representing a time distribution 
of data volume in a second direction in said data communication 
system in a second period of time: 

producing a correlation value representing a correlation of said first 
traffic waveform with said second traffic a r e f e r e nc e waveform: and 

producing a bandwidth anomaly signal when said correlation value 
satisfies a criterion. 

(Original) The method of claim 1 wherein producing said bandwidth 
anomaly signal comprises producing a denial of service attack signal 
when said correlation value is less than a reference value. 

(Original) The method of claim 2 wherein producing said bandwidth 
anomaly signal comprises determining whether said correlation value is 
less than said reference value. 

(Canceled) 

(Original) The method of claim 1 further comprising generating said 
first traffic waveform in response to a first set of traffic measurement 
values. 

(Original) The method of claim 5 wherein generating said first traffic 
waveform comprises subjecting said first set of traffic measurement values 
to a Discrete Wavelet Transform. 
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7. (Original) The method of claim 6 wherein subjecting said first set of 
traffic measurement values to said Discrete Wavelet Transform comprises 
using Haar wavelet filter coefficients in said Discrete Wavelet Transform. 

8. (Original) The method of claim 6 wherein generating said first traffic 
waveform comprises causing said Discrete Wavelet Transform to produce 
a first component, said first component representing said first traffic 
waveform. 

9. (Currently Amended) The method of claim 8 wherein producing said 
correlation value comprises correlating said first component with said 
referenc e second traffic w aveform. 

10. (Currently Amended) The method of claim 8 further comprising using 
a processor circuit to generate said first traffic waveform and to correlate 
said first traffic waveform with said reference second traffic w aveform. 

11. (Original) The method of claim 1 wherein said first traffic waveform 
represents a statistical measure of a time distribution of data volume in 
said first direction. 

12. (Original) The method of claim 5 further comprising monitoring data in 
said first direction and producing said first set of traffic measurement 
values in response thereto. 

13. (Original) The method of claim 12 wherein producing said first set of 
traffic measurement values comprises producing values representing a 
property of an Ethernet statistics group in a remote monitoring protocol. 

14. (Original) The method of claim 13 further comprising causing a 
processor circuit operable to produce said first traffic waveform to 
communicate with a communication interface to receive said values 
representing said property of an Ethernet statistics group. 

15. (Original) The method of claim 12 wherein monitoring said data in said 
first direction comprises at least one of: counting packets and counting 
octets, in said first direction. 

16. (Original) The method of claim 15 further comprising causing a 
processor circuit operable to produce said first traffic waveform to 
communicate with at least one of a packet counter and an octet counter to 
receive values representing said first set of traffic measurement values. 
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17. (Original) The method of claim 16 further comprising causing said 
processor circuit to implement at least one of said packet counter and said 
octet counter. 

18. (Original) The method of claim 12 further comprising passively 
monitoring said data in said first direction. 

19. (Original) A data communication method comprising transmitting and 
receiving data from a data communication system, the data 
communication system method of claim 12 and further comprising 
signaling an operator in response to said bandwidth anomaly signal. 

20. (Original) A data communication method comprising transmitting and 
receiving data from a data communication system, the data 
communication system method of claim 12 and further comprising 
controlling at least one of transmission and reception of data from said 
data communication system in response to said bandwidth anomaly 
signal. 

21 . (Currently Amended) The method of claim [[4]] 1_further comprising 
generating said first and second traffic waveforms in response to first and 
second sets of traffic measurement values, representing traffic in said first 
and second directions on said data communication system, respectively. 

22. (Original) The method of claim 21 wherein receiving said first and 
second traffic waveforms comprises receiving first and second waveforms 
representing first and second statistical measures of first and second time 
distributions respectively of data volume in first and second directions in 
said data communications system. 

23. (Original) The method of claim 21 wherein generating said first and 
second traffic waveforms comprises subjecting said first and second sets 
of traffic measurement values respectively, to a Discrete Wavelet 
Transform. 

24. (Original) The method of claim 23 wherein subjecting said first and 
second sets of traffic measurement values to said Discrete Wavelet 
Transform comprises using Haar wavelet filter coefficients in said Discrete 
Wavelet Transform. 

25. (Original) The method of claim 23 further comprising causing said 
Discrete Wavelet Transform to produce a first component, representing 
said first traffic waveform and a second component representing said 
second traffic waveform. 
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26. (Original) The method of claim 25 wherein producing said correlation 
value comprises correlating said first and second components. 

27. (Original) The method of claim 25 further comprising implementing a 
traffic waveform generator in a processor circuit used to produce said 
correlation value. 

28. (Original) The method of claim 21 further comprising monitoring data in 
said first and second directions and producing said first and second sets 
of traffic measurement values respectively in response thereto. 

29. (Original) The method of claim 28 wherein producing said first and 
second sets of traffic measurement values comprises producing values 
representing a property of an Ethernet statistics group in a remote 
monitoring protocol, for each of said first and second directions. 

30. (Original) The method of claim 29 further comprising causing a 
processor circuit operable to produce said first and second traffic 
waveforms to communicate with a communication interface to receive said 
values representing a property of an Ethernet statistics group. 

31. (Original) The method of claim 28 wherein monitoring said data 
comprises at least one of: packet counters and octet counters in each of 
said first and second directions. 

32. (Original) The method of claim 28 further comprising causing a 
processor circuit operable to produce said first and second traffic 
waveforms to communicate with at least one of a packet counter and an 
octet counter to receive values representing said first and second sets of 
traffic measurement values. 

33. (Original) The method of claim 32 further comprising causing said 
processor circuit to implement at least one of said packet counter and said 
octet counter. 

34. (Original) The method of claim 28 further comprising passively 
monitoring said data in said first and second directions. 

35. (Original) A data communication method comprising transmitting and 
receiving data from a data communication system, the data 
communication method of claim 1 and further comprising signaling an 
operator in response to said bandwidth anomaly signal. 

36. (Original) A data communication method comprising transmitting and 
receiving data from a data communication system, the data 
communication method of claim 1 and further comprising controlling at 
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least one of the transmission and reception of data from said data 
communication system in response to said bandwidth anomaly signal. 

37. (Currently Amended) An apparatus for detecting bandwidth 
anomalies in a data communication system, the apparatus comprising: 

means for receiving a first traffic waveform representing a time 
distribution of data volume in a first direction in said data 
communication system in a first period of time; 

means for receiving a second traffic waveform representing a time 
distribution of data volume in a second direction in said data 
communication system in a second period of time; 

means for producing a correlation value representing a correlation 
of said first traffic waveform with said second traffic a ref e rence 
waveform; and 

means for producing a bandwidth anomaly signal when said 
correlation value satisfies a criterion. 

38. (Currently Amended) A computer readable medium encoded with 
computer executable instructions for directing a processor circuit to detect 
bandwidth anomalies in a data communication system, the instructions 
comprising: 

instructions for causing the processor circuit to receive a first traffic 
waveform representing a time distribution of data volume in a first 
direction in said data communication system in a first period of 
time; 

instructions for causing the processor circuit to receive a second 
traffic waveform representing a time distribution of data volume in a 
second direction on said data communication system in a second 
period of time; 

instructions for causing the processor circuit to produce a 
correlation value representing a correlation of said first traffic 
waveform with said second traffic a roforenc e w aveform; and 

instructions for causing the processor circuit to produce a 
bandwidth anomaly signal when said correlation value satisfies a 
criterion. 

39. (Canceled) 
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40. 



(Currently Amended) An apparatus for detecting bandwidth 
anomalies in a data communication system, the apparatus comprising: 



a processor circuit configured to: 

receive a first traffic waveform representing a time 
distribution of data volume in a first direction in said data 
communication system in a first period of time; 

receive a second traffic waveform representing a time 
distribution of data volume in a second direction in said data 
communication system in a second period of time: 

produce a correlation value representing a correlation of said 
first traffic waveform with said second traffic a r o f o ronce 
waveform; and 

produce a bandwidth anomaly signal when said correlation 
value satisfies a criterion. 

41 . (Original) The apparatus of claim 40 wherein said processor circuit is 
configured to produce said bandwidth anomaly signal when said 
correlation value is less than a reference value. 

42. (Original) The apparatus of claim 41 wherein said processor circuit is 
configured to determine whether said correlation value is less than said 
reference value. 

43. (Canceled) 

44. (Original) The apparatus of claim 40 further comprising a first traffic 
waveform generator operable to receive a first set of traffic measurement 
values and to produce said first traffic waveform in response thereto. 

45. (Original) The apparatus of claim 44 wherein said first traffic waveform 
generator is configured to produce said first traffic waveform by subjecting 
said first set of traffic measurement values to a Discrete Wavelet 
Transform. 

46. (Original) The apparatus of claim 45 wherein said first traffic waveform 
generator is configured to use Haar wavelet filter coefficients in said 
Discrete Wavelet Transform. 

47. (Original) The apparatus of claim 45 wherein said first traffic waveform 
generator is configured to cause said Discrete Wavelet Transform to 
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produce a first component, said first component representing said first 
traffic waveform. 

48. (Currently Amended) The apparatus of claim 47 wherein said 
processor circuit is configured to produce said correlation value by 
correlating said first component with said r e f e r e nc e second traffic 
waveform. 

49. (Original) The apparatus of claim 44 wherein said processor circuit is 
configured to implement said first traffic waveform generator. 

50. (Original) The apparatus of claim 40 wherein said first traffic waveform 
represents a statistical measure of a time distribution of data volume in 
said first direction. 

51. (Original) The apparatus of claim 44 further comprising a 
communication interface operable to monitor data in said first direction 
and to produce said first set of traffic measurement values in response 
thereto. 

52. (Original) The apparatus of claim 51 wherein said communication 
interface produces values representing a property of an Ethernet statistics 
group in a remote monitoring protocol. 

53. (Original) The apparatus of claim 52 wherein said processor circuit is 
configured to communicate with said communication interface to receive 
said values representing a property of an Ethernet statistics group, said 
values representing said first set of traffic measurement values. 

54. (Original) The apparatus of claim 51 wherein said communication 
interface includes at least one of a packet counter and an octet counter 
operable to count a corresponding one of packets and octets of data in 
said first direction. 

55. (Original) The apparatus of claim 54 wherein said processor circuit is 
configured to communicate with said communication interface to receive 
values produced by at least one of a said packet counter and said octet 
counter, said values representing said first set of traffic measurement 
values. 

56. (Original) The apparatus of claim 55 wherein said processor circuit is 
configured to implement said communication interface. 

57. (Original) The apparatus of claim 51 further comprising a passive 
monitor operable to passively monitor said data in said first direction and 
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to provide a copy of said data in said first direction to said communication 
interface. 

58. (Original) A data communication apparatus operable to transmit and 
receive data from a data communication system, the data communication 
apparatus comprising the apparatus of claim 51 and further comprising a 
signaling device for signaling an operator in response to said bandwidth 
anomaly signal. 

59. (Original) A data communication apparatus operable to transmit and 
receive data from a data communication system, the data communication 
apparatus comprising the apparatus of claim 51 and further comprising a 
communication control device for controlling at least one of the 
transmission and reception of data from said data communication system 
in response to said bandwidth anomaly signal. 

60. (Currently Amended) The apparatus of claim [[43]] 40 further 
comprising a traffic waveform generator operable to receive first and 
second sets of traffic measurement values and to produce said first and 
second traffic waveforms in response thereto. 

61. (Original) The apparatus of claim 60 wherein said processor is 
configured to receive first and second traffic waveforms representing first 
and second statistical measures of first and second time distributions 
respectively of data volume in first and second directions in said data 
communications system. 

62. (Original) The apparatus of claim 60 wherein said traffic waveform 
generator is configured to produce said first and second traffic waveforms 
by subjecting said first and second sets of traffic measurement values 
respectively, to a Discrete Wavelet Transform. 

63. (Original) The apparatus of claim 62 wherein said traffic waveform 
generator is configured to use Haar wavelet filter coefficients in said 
Discrete Wavelet Transform. 

64. (Original) The apparatus of claim 62 wherein said traffic waveform 
generator is configured to cause said Discrete Wavelet Transform to 
produce a first component, representing said first traffic waveform and a 
second component representing said second traffic waveform. 

65. (Original) The apparatus of claim 64 wherein said processor circuit is 
configured to produce said correlation value by correlating said first and 
second components. 
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66. (Original) The apparatus of claim 64 wherein said processor circuit is 
configured to implement said traffic waveform generator. 

67. (Original) The apparatus of claim 60 further comprising a 
communication interface operable to monitor data in said first and second 
directions and to produce said first and second sets of traffic 
measurement values respectively in response thereto. 

68. (Original) The apparatus of claim 67 wherein said communication 
interface produces values representing a property of an Ethernet statistics 
group in a remote monitoring protocol, for each of said first and second 
directions. 

69. (Original) The apparatus of claim 68 wherein said processor circuit is 
configured to communicate with said communication interface to receive 
said values representing a property of an Ethernet statistics group, for 
each of said first and second directions, said values representing said first 
and second sets of traffic measurement values respectively. 

70. (Original) The apparatus of claim 67 wherein said communication 
interface includes at least one of a packet counter and an octet counter 
operable to count a corresponding one of packets and octets of data for 
each of said first and second directions. 

71. (Previously Presented) The apparatus of claim 70 wherein said 
processor circuit is configured to communicate with said communication 
interface to receive values produced by at least one of said packet counter 
and said octet counter, said values representing said first and second sets 
of traffic measurement values. 

72. (Original) The apparatus of claim 67 wherein said processor circuit is 
configured to implement said communication interface. 

73. (Original) The apparatus of claim 67 further comprising a passive 
monitor operable to passively monitor said data in said first and second 
directions and to provide copies of said data to said communication 
interface. 

74. (Original) A data communication apparatus operable to transmit and 
receive data from a data communication system, the data communication 
apparatus comprising the apparatus of claim 40 and further comprising a 
signaling device for signaling an operator in response to said bandwidth 
anomaly signal. 

75. (Original) A data communication apparatus operable to transmit and 
receive data from a data communication system, the data communication 
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apparatus comprising the apparatus of claim 40 and further comprising a 
communication control device for controlling at least one of the 
transmission and reception of data from said data communication system 
in response to said bandwidth anomaly signal. 
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